Cameron to spend £1bn+ on cyber security

Operation 'active defence' is go

David Cameron will next week allocate more than a billion pounds to a cross-government effort to bolster Britain's cyber security, Whitehall sources have told The Register.

The funding will be announced by the Prime Minister as part of the Strategic Defence and Security Review.

The largest share of the three-year budget will be used to acquire what sources call "active defence" capabilities against targeted attacks on critical civilian networks such those that run utilities and the NHS. Security chiefs will be able to order technicians to trace and block attacks.

Methods might include distributed denial of service against attackers, or more sophisticated methods such as taking over command-and-control servers. Senior sources with intimate knowledge of the intelligence services also agree that Britain is one of half a dozen nations with the technical expertise to create Stuxnet-style bespoke malware.

Cabinet Office officials have been examining the legal ramifications of such responses for a year.

Sources said GCHQ, in Cheltenham, will be the hub of the new defences. It has hosted the Cyber Security Operations Centre since November 2009, so far focused on gathering intelligence on online threats rather than directly responding to them.

In a speech this week, GCHQ director Ian Lobban made oblique reference to the coming new "active defence" capabilities when he said 20 per cent of the online threat "is complex and not easily addressed by just building the security walls higher and higher".

The military will also benefit from the spending. Officials in the Ministry of Defence are currently liaising on training with Pentagon counterparts who set up US Cyber Command. A corps of British cyber security personnel will be tasked with defending military networks, and attacking those of battlefield enemies.

As well as dealing with attacks, the new cyber security budget will also be used to bolster Britain's digital defences against espionage. Government and commercial networks are continually probed for weaknesses, Lobban reaffirmed this week.

Chinese infiltrators targeted Rolls Royce in 2007 and stole the full secret blueprints for one of its jet engines, sources said. The raid was publicly played down as a mostly a failure at the time, but its success privately shocked security mandarins.

The decision to allocate more than a billion pounds to cyber security, at a time when other defence and intelligence spending is being squeezed is, in part, Britain's response. ®